Securities Regulation Daily Wrap Up, RISK MANAGEMENT—Cyber battle: government hacking bill would upend court rules fix, (May 20, 2016)
Organizations Mentioned:New York Stock Exchange, Inc.
Senator Ron Wyden (D-Ore) introduced a bill that would bar implementation of a proposed change to federal court procedural rules that will clarify the authority of judges to issue warrants for remote electronic searches. Federal court rules typically are the nearly exclusive province of the lawyers and judges who use them daily in litigation practice, but the recent public debate over whether and how the federal government should deal with encryption and other anonymizing technologies has made these rules front page news.
Privacy and the U.S. Constitution. The Wyden bill, announced via press release and styled the Stopping Mass Hacking Act (S. 2952), states plainly that any proposed changes to Rule 41 of the Federal Rules of Criminal Procedure cannot take effect. Wyden and co-sponsors Sens. Rand Paul (R-Ky), Tammy Balwin (D-Wis), Steve Daines (R-Mont), and Jon Tester (D-Mont), argue that amended Rule 41 would give the government unfettered ability to search millions of peoples’ electronic information upon the issuance of just one warrant. They say the rules revamp implicates privacy rights and the Fourth Amendment.
According to an FAQ, the government typically implements remote warrants by utilizing malware that can hack a targeted computer. The bill’s authors claim that remote searches are often undisclosed, are governed by scant case law, may not always result in notice to those hacked, and could even put a targeted computer at risk of being hacked by others. For Wyden and his co-sponsors, the issue of warrants for remote searches is a substantive, not procedural, matter that should be addressed by Congress.
Not waiting for Congress. In its transmittal letter to Chief Justice John Roberts and the Judicial Conference, a rules committee report said that proposed changes to Rule 41 are intended to impact two specific situations involving computers that are not currently addressed by the four instances when a judge can issue warrants for property outside of a court’s district. The report emphasized that, contrary to some of the 44 written comments and public testimony received, the amended rule would not alter constitutional requirements for warrants and is instead meant to clarify venue.
The Advisory Committee on Criminal Rules previously replied to opposition to the amended rule by noting that electronic searches already occur, but only if the government can identify the proper district and there is probable cause to issue a warrant. But the advisory committee went on to pose a scenario in which hackers used anonymizing technology to infiltrate the New York Stock Exchange. The advisory committee suggested that the government would be unable to get a warrant in any district under current Rule 41.
Yet the advisory committee reserved perhaps its strongest language for handling the lone dissenter’s objection to forwarding its recommendation to the Standing Committee on Rules of Practice and Procedure. According to the advisory committee, amended Rule 41 is about venue and, thus, practice and procedure, topics on which the committee can act and to which Congress can respond. The dissenter had argued that the change was substantive due to its impact on privacy rights and should be taken up first by Congress.
Amended Rule 41. Rule 41(b) would be renamed to reflect which courts can mull warrant applications. Specifically, a magistrate judge would have authority to issue a warrant to use remote access to search electronic storage media and to seize or copy electronically stored information, even if it is not located in the district. A committee note to the revision explains that the change does not seek to prescribe applicable constitutional standards, but would instead let these matters evolve via case law.
One subsection to new Rule 41(b)(6) deals with media or information that has been concealed via technology, such as anonymizing software. A second subsection addresses unauthorized damage to protected computers (i.e., exclusively for use by financial institutions and the federal government, or is used in or affecting interstate or foreign commerce or communication) that are located in five or more districts. This latter provision would cover the use of botnets and permit consolidation of the proceeding before one judge without any need to issue many warrants across multiple districts.
Rule 41(f)(1)(C) would require an officer executing a remote access warrant to make reasonable efforts to serve a copy of the warrant and a receipt on the person whose property was searched or who possessed the information that was seized or copied. The provision also clarifies that service can be had via any means reasonably calculated to reach the person, including by electronic means. The committee note reiterated that delayed notice would be an option only to the extent it is permitted by law. An earlier advisory committee report said the change was a nod to the practical realities of providing notice in the remote search setting as compared to the more familiar rubric of tangible property.
LegislativeActivity: Enforcement RiskManagement